mirror of
https://github.com/harness/drone.git
synced 2025-05-05 21:19:37 +08:00
3ba0f75c8d
This change adds the following:
- Space UID + Custom harness validation (accountId for top level space, harness identifier for child spaces)
- Repo UID + Custom harness validation (harness identifier)
- Store Unique casing of space / repo path and add Path.ValueUnique (with Unique index) to allow for application layer controlling the case sensitivity (case insensitive standalone vs partially case sensitive harness)
- Token UID (unique index over ownertype + ownerID + tokenUID)
- Add DisplayName for principals (replaces Name to avoid confustion)
- Store Unique casing of principal UID and add Principal.ValueUnique (with unique index) to allow for application layer, per principal type control of case sensitivity (required in embedded mode)
- Generate serviceAccount UID (+Email) Randomly (sa-{space|repo}-{ID}-{random}) - Allows to have a unique UID across all principals while reducing likelyhood of overlaps with users + avoid overlap across spaces / repos.
- Sync casing of space names (accountId orgId projectId) when creating spaces on the fly (to ensure case sensitivity of - harness code) or use the existing space to update casing.
- Update serviceaccount client to match updated NG Manager API
- in embedded mode create spaces for harness resources owning the service account
112 lines
2.8 KiB
Go
112 lines
2.8 KiB
Go
// Copyright 2022 Harness Inc. All rights reserved.
|
|
// Use of this source code is governed by the Polyform Free Trial License
|
|
// that can be found in the LICENSE.md file for this repository.
|
|
|
|
package token
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/harness/gitness/internal/store"
|
|
"github.com/harness/gitness/types"
|
|
"github.com/harness/gitness/types/enum"
|
|
)
|
|
|
|
const (
|
|
userTokenLifeTime time.Duration = 24 * time.Hour // 1 day.
|
|
oathTokenLifeTime time.Duration = 30 * time.Minute // 30 min.
|
|
)
|
|
|
|
func CreateUserSession(ctx context.Context, tokenStore store.TokenStore,
|
|
user *types.User, uid string) (*types.Token, string, error) {
|
|
principal := types.PrincipalFromUser(user)
|
|
return Create(
|
|
ctx,
|
|
tokenStore,
|
|
enum.TokenTypeSession,
|
|
principal,
|
|
principal,
|
|
uid,
|
|
userTokenLifeTime,
|
|
enum.AccessGrantAll,
|
|
)
|
|
}
|
|
|
|
func CreatePAT(ctx context.Context, tokenStore store.TokenStore,
|
|
createdBy *types.Principal, createdFor *types.User,
|
|
uid string, lifetime time.Duration, grants enum.AccessGrant) (*types.Token, string, error) {
|
|
return Create(
|
|
ctx,
|
|
tokenStore,
|
|
enum.TokenTypePAT,
|
|
createdBy,
|
|
types.PrincipalFromUser(createdFor),
|
|
uid,
|
|
lifetime,
|
|
grants,
|
|
)
|
|
}
|
|
|
|
func CreateSAT(ctx context.Context, tokenStore store.TokenStore,
|
|
createdBy *types.Principal, createdFor *types.ServiceAccount,
|
|
uid string, lifetime time.Duration, grants enum.AccessGrant) (*types.Token, string, error) {
|
|
return Create(
|
|
ctx,
|
|
tokenStore,
|
|
enum.TokenTypeSAT,
|
|
createdBy,
|
|
types.PrincipalFromServiceAccount(createdFor),
|
|
uid,
|
|
lifetime,
|
|
grants,
|
|
)
|
|
}
|
|
|
|
func CreateOAuth(ctx context.Context, tokenStore store.TokenStore,
|
|
createdBy *types.Principal, createdFor *types.User,
|
|
name string, grants enum.AccessGrant) (*types.Token, string, error) {
|
|
return Create(
|
|
ctx,
|
|
tokenStore,
|
|
enum.TokenTypeOAuth2,
|
|
createdBy,
|
|
types.PrincipalFromUser(createdFor),
|
|
name,
|
|
oathTokenLifeTime,
|
|
grants,
|
|
)
|
|
}
|
|
|
|
func Create(ctx context.Context, tokenStore store.TokenStore,
|
|
tokenType enum.TokenType, createdBy *types.Principal, createdFor *types.Principal,
|
|
uid string, lifetime time.Duration, grants enum.AccessGrant) (*types.Token, string, error) {
|
|
issuedAt := time.Now()
|
|
expiresAt := issuedAt.Add(lifetime)
|
|
|
|
// create db entry first so we get the id.
|
|
token := types.Token{
|
|
Type: tokenType,
|
|
UID: uid,
|
|
PrincipalID: createdFor.ID,
|
|
IssuedAt: issuedAt.UnixMilli(),
|
|
ExpiresAt: expiresAt.UnixMilli(),
|
|
Grants: grants,
|
|
CreatedBy: createdBy.ID,
|
|
}
|
|
|
|
err := tokenStore.Create(ctx, &token)
|
|
if err != nil {
|
|
return nil, "", fmt.Errorf("failed to store token in db: %w", err)
|
|
}
|
|
|
|
// create jwt token.
|
|
jwtToken, err := GenerateJWTForToken(&token, createdFor.Salt)
|
|
if err != nil {
|
|
return nil, "", fmt.Errorf("failed to create jwt token: %w", err)
|
|
}
|
|
|
|
return &token, jwtToken, nil
|
|
}
|